Network-Level Containment

# Palo Alto NGFW — block a C2 IP via CLI (SSH to the firewall)

# Create an address object for the C2 IP
set address "C2-IR-2026-023" ip-netmask 185.220.101.47/32
commit

# Create a security policy rule to block it (insert at top of ruleset)
set rulebase security rules "BLOCK-C2-IR-2026-023" from any
set rulebase security rules "BLOCK-C2-IR-2026-023" to any
set rulebase security rules "BLOCK-C2-IR-2026-023" source any
set rulebase security rules "BLOCK-C2-IR-2026-023" destination "C2-IR-2026-023"
set rulebase security rules "BLOCK-C2-IR-2026-023" application any
set rulebase security rules "BLOCK-C2-IR-2026-023" service any
set rulebase security rules "BLOCK-C2-IR-2026-023" action deny
set rulebase security rules "BLOCK-C2-IR-2026-023" log-start yes
set rulebase security rules "BLOCK-C2-IR-2026-023" log-end yes
commit

# Move the rule to the top (before any allow rules)
move rulebase security rules "BLOCK-C2-IR-2026-023" top
commit

# Block a C2 domain using URL filtering category (faster, handles IP rotation)
# Add to a custom URL category:
set profiles url-filtering "IR-Block-List" block custom-url-categories "IR-C2-Domains"
set custom-url-category "IR-C2-Domains" list [ "evil-c2-domain.com" "another-c2.net" ]
commit

# Windows Defender Firewall — block outbound C2 connections fleet-wide via GPO
# Create the rule locally first, test, then deploy via GPO

# Block outbound to known C2 IP
New-NetFirewallRule `
    -DisplayName "IR-Block-C2-185.220.101.47" `
    -Direction Outbound `
    -RemoteAddress "185.220.101.47" `
    -Action Block `
    -Profile Any `
    -Enabled True

# Block SMB outbound (east-west spread prevention)
New-NetFirewallRule `
    -DisplayName "IR-Block-SMB-Outbound-Workstations" `
    -Direction Outbound `
    -Protocol TCP `
    -RemotePort 445 `
    -Action Block `
    -Profile Any `
    -Enabled True

# Apply the same rule to all machines via Group Policy:
# Computer Config > Windows Settings > Security Settings >
#   Windows Defender Firewall with Advanced Security > Outbound Rules
# Or use LGPO.exe to push the policy file to all machines via startup script

# BIND DNS sinkhole configuration
# Add to named.conf or a dedicated include file

# Define the sinkhole zone
zone "evil-c2-domain.com" {
    type master;
    file "/etc/bind/sinkhole.zone";
    allow-query { any; };
};

zone "another-c2.net" {
    type master;
    file "/etc/bind/sinkhole.zone";
    allow-query { any; };
};

; Sinkhole zone file — redirects all queries to internal sinkhole server
$TTL 60
@   IN SOA  ns1.corp.local. admin.corp.local. (
            2026091901  ; serial
            3600        ; refresh
            900         ; retry
            604800      ; expire
            60 )        ; minimum TTL

@   IN NS   ns1.corp.local.
@   IN A    10.99.99.99    ; sinkhole server IP
*   IN A    10.99.99.99    ; wildcard — catches all subdomains too

# Windows DNS Server sinkhole (if your internal DNS is Windows)
# Requires DNS Server module (RSAT feature)

$sinkIP    = "10.99.99.99"
$c2Domains = @("evil-c2-domain.com", "another-c2.net")

foreach ($domain in $c2Domains) {
    # Create a primary zone for the C2 domain
    Add-DnsServerPrimaryZone -Name $domain `
        -ZoneFile "$domain.dns" `
        -PassThru

    # Add a wildcard A record pointing to the sinkhole server
    Add-DnsServerResourceRecordA -Name "@"  -ZoneName $domain -IPv4Address $sinkIP
    Add-DnsServerResourceRecordA -Name "*"  -ZoneName $domain -IPv4Address $sinkIP
    Write-Host "Sinkholed: $domain → $sinkIP"
}

# On the sinkhole server (10.99.99.99): log all connection attempts
# Any web server with request logging enabled is sufficient
# IIS: check C:\inetpub\logs\LogFiles\
# nginx: access_log /var/log/nginx/sinkhole_access.log

# Cisco IOS — move a switch port to the quarantine VLAN
# SSH to the switch, then:

configure terminal

# Define the quarantine VLAN if it doesn't exist
vlan 999
 name QUARANTINE-IR
 exit

# Move the infected machine's port to quarantine VLAN
# First, identify the port by MAC address:
# show mac address-table address 00:11:22:33:44:55
# Find the interface column — e.g., GigabitEthernet1/0/12

interface GigabitEthernet1/0/12
 switchport access vlan 999
 shutdown     ! optionally shut the port entirely for full isolation
 no shutdown  ! bring it back up in quarantine VLAN if you want network connectivity for mgmt
 exit

end
write memory

# Verify
show interfaces GigabitEthernet1/0/12 trunk
show vlan brief | include 999